Attestkeep
Language: English
Sign up

Vulnerabilities / CVE-2024-28859

critical

CVE-2024-28859

Deserialization Gadget chain in Swift Mailer

Published Modified CWE 502
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.

Severity by source

NVD9.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
GHSA5.0CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by GHSA (medium).

Description

Symfony1 is a community fork of symfony 1.4 with DIC, form enhancements, latest Swiftmailer, better performance, composer compatible and PHP 8 support. Symfony 1 has a gadget chain due to vulnerable Swift Mailer dependency that would enable an attacker to get remote code execution if a developer unserialize user input in his project. This vulnerability present no direct threat but is a vector that will enable remote code execution if a developper deserialize user untrusted data. Symfony 1 depends on Swift Mailer which is bundled by default in vendor directory in the default installation since 1.3.0. Swift Mailer classes implement some `__destruct()` methods. These methods are called when php destroys the object in memory. However, it is possible to include any object type in `$this->_keys` to make PHP access to another array/object properties than intended by the developer. In particular, it is possible to abuse the array access which is triggered on foreach($this->_keys ...) for any class implementing ArrayAccess interface. This may allow an attacker to execute any PHP command which leads to remote code execution. This issue has been addressed in version 1.5.18. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected packages and fixed versions

SourcePackageFixed in
composer::GitHub Security Advisory Composerfriendsofsymfony1/swiftmailer, friendsofsymfony1/symfony1, swiftmailer/swiftmailer5.4.13, 6.2.5 and 2 more
composer::PHP Security Advisories Databasefriendsofsymfony1/swiftmailer, friendsofsymfony1/symfony1, swiftmailer/swiftmailerno fix listed
Show all 6 entries from 2 sources
SourcePackageFixed in
composer::GitHub Security Advisory Composerfriendsofsymfony1/swiftmailer5.4.13, 6.2.5
composer::GitHub Security Advisory Composerfriendsofsymfony1/symfony11.5.18
composer::GitHub Security Advisory Composerswiftmailer/swiftmailer6.2.5
composer::PHP Security Advisories Databasefriendsofsymfony1/swiftmailerno fix listed
composer::PHP Security Advisories Databasefriendsofsymfony1/symfony1no fix listed
composer::PHP Security Advisories Databaseswiftmailer/swiftmailerno fix listed

References

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.